Veritas NetBackup™ 8.0 Security and Encryption Guide
- Increasing NetBackup security
- About NetBackup security and encryption
- NetBackup security implementation levels
- World-level security
- Enterprise-level security
- Datacenter-level security overview
- NetBackup Access Control (NBAC)
- Combined world, enterprise, and data center levels
- NetBackup security implementation types
- Operating system security
- NetBackup security vulnerabilities
- Standard NetBackup security
- Media Server Encryption Option (MSEO) security
- Client side encryption security
- NBAC on master, media server, and graphical user interface security
- NBAC complete security
- All NetBackup security
- Security deployment models
- Workgroups
- Single datacenters
- Multi-datacenters
- Workgroup with NetBackup
- Single datacenter with standard NetBackup
- Single datacenter with Media Server Encryption Option (MSEO)
- Single datacenter with client side encryption
- Single datacenter with NBAC on master and media servers
- Single datacenter with NBAC complete
- Single datacenter with all security implemented
- Multi-datacenter with standard NetBackup
- Multi-datacenter with Media Server Encryption Option (MSEO)
- Multi-datacenter with client side encryption
- Multi-datacenter with NBAC on master and media servers
- Multi-datacenter with NBAC complete
- Multi-datacenter with all NetBackup security
- Port security
- About NetBackup TCP/IP ports
- About NetBackup daemons, ports, and communication
- Standard NetBackup ports
- NetBackup master server outgoing ports
- NetBackup media server outgoing ports
- NetBackup enterprise media management (EMM) server outgoing ports
- Client outgoing ports
- Windows administration console and Java server outgoing ports
- Java console outgoing ports
- About MSDP port usage
- About Cloud port usage
- Additional port information for products that interoperate with NetBackup
- About communication and firewall considerations
- Ports required to communicate with backup products
- Web browser to NetBackup Web GUI connection
- About NetBackup user interface and NetBackup server software communication
- About NetBackup server to NetBackup master server (NBSL) communication
- About SNMP traps
- About communication between NetBackup and Sybase database communication
- About email communication in NetBackup
- About configuring ports
- Enabling or disabling random port assignments
- Specifying firewall connection options on a NetBackup server or client
- Specifying firewall connection options for destination computers from a source computer
- Editing port information in configuration files
- Updating client connection options
- Updating port settings for the Media Manager in the vm.conf file
- Port requirements for NDMP backups
- Known firewall problems encountered when using NetBackup with third-party robotic products
- Auditing NetBackup operations
- About NetBackup auditing
- Viewing the current audit settings
- Configuring auditing on a NetBackup master server
- User identity in the audit report
- About Enhanced Auditing
- Enabling Enhanced Auditing
- Configuring Enhanced Auditing
- Disabling Enhanced Auditing
- Auditing host property changes
- Retaining and backing up audit trail records
- Viewing the audit report
- Using the command line -reason or -r option
- nbaudit log behavior
- Audit alert notification for audit failures
- Access control security
- NetBackup Access Control Security (NBAC)
- About using NetBackup Access Control (NBAC)
- NetBackup access management administration
- About NetBackup Access Control (NBAC) configuration
- Configuring NetBackup Access Control (NBAC)
- NBAC configuration overview
- Configuring NetBackup Access Control (NBAC) on standalone master servers
- Installing the NetBackup master server highly available on a cluster
- Configuring NetBackup Access Control (NBAC) on a clustered master server
- Configuring NetBackup Access Control (NBAC) on media servers
- Installing and configuring NetBackup Access Control (NBAC) on clients
- Establishing a trust relationship between the broker and the Windows remote console
- About including authentication and authorization databases in the NetBackup hot catalog backups
- NBAC configure commands summary
- Unifying NetBackup Management infrastructures with the setuptrust command
- Using the setuptrust command
- Configuring Access Control host properties for the master and media server
- Access Control host properties dialog for the client
- Troubleshooting Access Management
- Troubleshooting NBAC issues
- Configuration and troubleshooting topics for NetBackup Authentication and Authorization
- Windows verification points
- UNIX verification points
- Verification points in a mixed environment with a UNIX master server
- Verification points in a mixed environment with a Windows master server
- About the nbac_cron utility
- Using the nbac_cron utility
- Using the Access Management utility
- About determining who can access NetBackup
- Viewing specific user permissions for NetBackup user groups
- Granting permissions
- Authorization objects
- Media authorization object permissions
- Policy authorization object permissions
- Drive authorization object permissions
- Report authorization object permissions
- NBU_Catalog authorization object permissions
- Robot authorization object permissions
- Storage unit authorization object permissions
- DiskPool authorization object permissions
- BUAndRest authorization object permissions
- Job authorization object permissions
- Service authorization object permissions
- HostProperties authorization object permissions
- License authorization object permissions
- Volume group authorization object permissions
- VolumePool authorization object permissions
- DevHost authorization object permissions
- Security authorization object permissions
- Fat server authorization object permissions
- Fat client authorization object permissions
- Vault authorization object permissions
- Server group authorization object permissions
- Key management system (kms) group authorization object permissions
- Upgrading NetBackup Access Control (NBAC)
- Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine
- Security certificates in NetBackup
- Overview of security certificates in NetBackup
- About the Security Management utilities
- About host name-based certificates
- About host ID-based certificates
- Web login requirements for nbcertcmd command options
- Using the Certificate Management utility to issue and deploy host ID-based certificates
- About certificate deployment security levels
- Automatic host ID-based certificate deployment
- Deploying host ID-based certificates
- Implication of clock skew on certificate validity
- Setting up trust with the master server (Certificate Authority)
- Deploying certificates from multiple masters
- Forcing or overwriting certificate deployment
- Retaining host ID-based certificates when reinstalling NetBackup on non-master hosts
- Deploying certificates on a client that has no connectivity with the master server
- About host ID-based certificate expiration and renewal
- Cleaning host ID-based certificate information from a host before cloning a virtual machine
- About reissuing host ID-based certificates
- About Token Management for host ID-based certificates
- About revoking host ID-based certificates
- Security certificate deployment in a clustered NetBackup setup
- About deployment of a host ID-based certificate on a clustered NetBackup host
- Deploying a host ID-based certificates on inactive master server nodes
- Deploying a host ID-based certificate on a clustered NetBackup media server (upgrade only)
- Renewing a host ID-based certificate on a clustered NetBackup host
- About deploying a new host ID-based certificate
- Viewing certificate details for a clustered NetBackup setup
- Removing CA certificates from a clustered NetBackup setup
- Data at rest encryption security
- Data at rest encryption terminology
- Data at rest encryption considerations
- Encryption security questions to consider
- Comparison of encryption options
- About NetBackup client encryption
- Configuring standard encryption on clients
- Managing standard encryption configuration options
- Managing the NetBackup encryption key file
- About configuring standard encryption from the server
- Restoring an encrypted backup file to another client
- About configuring standard encryption directly on clients
- Setting standard encryption attribute in policies
- Changing the client encryption settings from the NetBackup server
- Configuring legacy encryption on clients
- About configuring legacy encryption from the client
- About configuring legacy encryption from the server
- Restoring a legacy encrypted backup created on another client
- About setting legacy encryption attribute in policies
- Changing client legacy encryption settings from the server
- Additional legacy key file security for UNIX clients
- Media server encryption
- Data at rest key management
- Federal Information Processing Standards (FIPS)
- About FIPS enabled KMS
- About the Key Management Service (KMS)
- Installing KMS
- Configuring KMS
- Creating the key database
- About key groups and key records
- Overview of key record states
- About backing up the KMS database files
- About recovering KMS by restoring all data files
- Recovering KMS by restoring only the KMS data file
- Recovering KMS by regenerating the data encryption key
- Problems backing up the KMS data files
- Solutions for backing up the KMS data files
- Creating a key record
- Listing keys from a key group
- Configuring NetBackup to work with KMS
- About using KMS for encryption
- KMS database constituents
- Command line interface (CLI) commands
- CLI usage help
- Create a new key group
- Create a new key
- Modify key group attributes
- Modify key attributes
- Get details of key groups
- Get details of keys
- Delete a key group
- Delete a key
- Recover a key
- About exporting and importing keys from the KMS database
- Modify host master key (HMK)
- Get host master key (HMK) ID
- Get key protection key (KPK) ID
- Modify key protection key (KPK)
- Get keystore statistics
- Quiesce KMS database
- Unquiesce KMS database
- Key creation options
- Troubleshooting KMS
Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine
You can use the following steps for upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote computer.
Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine
- Before upgrading to NetBackup, stop the NetBackup services and disable NBAC by setting USE_VXSS=PROHIBITED. To set the new value for USE_VXSS, run the following command. Then start the NetBackup upgrade.
On UNIX platforms, use
/usr/openv/netbackup/bin/admincmd/bpsetconfig bpsetconfig> USE_VXSS=PROHIBITED bpsetconfig>Crtl + D (to save and quit).
On Windows, use
C:\Program Files\Veritas\NetBackup\bin\admincmd\bpsetconfig bpsetconfig> USE_VXSS=PROHIBITED bpsetconfig> Crtl + Z + Enter (to save and quit).
- Once the NetBackup upgrade is completed then migrates the remote root broker (RB) and local shared authentication broker (AB) into NetBackup by using the atutil tool which is shipped with NetBackup.
- Copy the atutil utility from the NetBackup computer to the root broker computer.
On UNIX Platforms, copy the /usr/openv/netbackup/sec/at/bin/atutil file from NetBackup computer to the root broker computer.
On Windows, copy the C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil.exe file from NetBackup computer to the root broker computer.
- Change directory to where the atutil command was copied. Then export the root broker by running the atutil export -r -f <RB output xml file> -p <password> command.
- Copy the exported file to NetBackup computer.
- Import the root broker into the NetBackup computer by executing the following command.
On UNIX platforms, execute /usr/openv/netbackup/sec/at/bin/atutil import -z /usr/openv/var/global/vxss/eab/data/ -f <RB output xml file> -p <password>
On Windows, execute C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil import -z C:\Program Files\Veritas\NetBackup\var\global\vxss\eab\data -f <RB output xml file> -p <password>
On cluster computers, the -z option should point to the shared drive.
- Configure the NetBackup authentication service in R+AB mode by running the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/at/bin/vssregctl -s -f /usr/openv/var/global/vxss/eab/data/root/.VRTSat/profile/VRTSatlocal.conf -b "Security\Authentication\Authentication Broker" -k Mode -t int -v 3
On Windows, run C:\Program Files\Veritas\NetBackup\sec\at\bin\vssregctl -s -f C:\Program Files\VERITAS\NetBackup\var\global\vxss\eab\data\systemprofile\VRTSatlocal.conf -b "Security\Authentication\Authentication Broker" -k Mode -t int -v 3
On cluster computers set the - f option to point to the shared drive.
- Set the value of USE_VXSS to AUTOMATIC to start the authentication service. To set a new value for USE_VXSS run following command.
On UNIX platforms,
/usr/openv/netbackup/bin/admincmd/bpsetconfig bpsetconfig> USE_VXSS=AUTOMATIC bpsetconfig> Crtl + D (to save and quit).
On Windows,
C:\Program Files\Veritas\NetBackup\bin\admincmd\bpsetconfig bpsetconfig> USE_VXSS=AUTOMATIC bpsetconfig> Crtl + Z + Enter (to save and quit).
- Start the NetBackup authentication service by running the following command.
On UNIX platforms, run /usr/openv/netbackup/bin/nbatd.
On Windows, run net start nbatd.
- Reset the value of USE_VXSS to PROHIBITED.
On UNIX platforms manually edit the
/usr/openv/netbackup/bp.conffile and set USE_VXSS to PROHIBITED.On Windows, open the registry entry for HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\NetBackup\CurrentVersion\Config and set the value of USE_VXSS to PROHIBITED.
- Export the shared AB domain and import it into NetBackup by running the following command.
On UNIX platforms, execute the following commands in sequence.
/usr/openv/netbackup/sec/at/bin/atutil export -t ab -f <AB output xml file> -p <password> /usr/openv/netbackup/sec/at/bin/atutil import -z /usr/openv/var/global/vxss/eab/data/ -f <AB output xml file> -p <password>.
On Windows, execute the following commands in sequence.
C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil export -t ab -d broker -f <AB output xml file> -p <password> C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil import -z C:\Program Files\Veritas\NetBackup\var\global\vxss\eab\data -f <AB output xml file> -p <password>
On cluster computers the - z option should point to the shared drive.
- Start the NetBackup authorization service by executing the following commands.
On UNIX platforms, run /usr/openv/netbackup/bin/nbazd -f.
On Windows, run net start nbazd.
- Log on to the shared AZ service.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz login --domain localhost.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz login --domain localhost.
On Windows X64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz login --domain localhost.
- Find the NetBackup APS name from the shared AZ using the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz listaps.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz listaps.
On Windows X64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz listaps.
- Export the NetBackup resource collection from the shared AZ by running the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz rcexport --toplevelrcname <NBU APS name>.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\vssaz rcexport --toplevelrcname <NBU APS name>.
On Windows x64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\vssaz rcexport --toplevelrcname <NBU APS name>.
- Log out from the shared AZ using the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz logout.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz logout.
On Windows x64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz logout.
- Log on to NetBackup AZ using the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/az/bin/vssaz login --domain localhost.
On Windows, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz login --domain localhost.
- Import the NetBackup resource collection from shared AZ into NetBackup using the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/az/bin/vssaz rcimport --location /var/VRTSaz/objdb/export/<OID>/rc_<OID>.xml.
On Windows x86 platforms, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz rcimport --location C:\Program Files\VERITAS\Security\Authorization\data\objdb\export \<OID>\rc_<OID>.xml.
On Windows x64 platforms, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz rcimport --location C:\Program Files (x86)\VERITAS\Security\Authorization\data\objdb\export \<OID>\rc_<OID>.xml.
- Restart the NetBackup service in USE_VXSS = PROHIBITED mode.
- Run the setupmaster command.
- Restart the NetBackup service.